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Page 1 of 2 


From: Help. Desk 

Sent: Thursday. June 19. 2003 5:55 PM 

Subject: TSCD Submission - Site 17 AL - 06/19/03 1545 | | 

TECHNICAL SUPPORT CENTER DESK INCIDENT 
REPORT 


TSCD Type: 

Call Type: 

Date of call: 

Time of call: 

Date call returned: 
Time call returned: 
Site calling: 

Software baseline; 
Site Contact : 

Callers phone number: 
Engineer: 

Category: 


Regular Hours 
Initial 
06/19/03 
1545 

06/19/03 
1600 
17 AL 



h2 

he 

h7C 

h7E 


Problem Description; 



Action taken: 





ALL IHFORHATIOIJ COJITAIIlEIi 
10/4/2006 HEKEIIf 13 OTCLAS3IFIED 

DATE 06-04-2007 BY 6S179DHH/KSR/LHF 
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From: Help. Desk 

Sent: Wednesday, September 24^^003 2.09 PM 

Subject: TSCD Submission - Site a 09/22/03 1752 - I I 

TECHNICAL SUPPORT CENTER DESK INCIDENT 
REPORT 


TSCD Type: 

Call Type: 

Date of call: 

Time of call : 

Date call returned: 
Time call returned: 
Site 'calling: 

Software baseline: 
Site Contact : 

Callers phone number: 
Engineer: 

Category: 


Other 

Initial 

09/22/03 

17S2 


09/22/03 




Problem Description: 

I^^Jhad several problems: 


1; He wanted to know how to save a transcript to a floppy 
2; od3 will not archive 

3: the case ID on the sessions that were being sent to them 
by WFO was wrong and he wanted to . change it. 

4: He had queue = 3 for odl in the system status window. He 



up on the dcs3000 system. 


b2 

b7E 


Action taken: 

1: 1 walked him through saving a transcript to a floppy. 

2: Cycled power on the drives and it started working. 

3: I told him that he can't change the case ID. If it’s 
wrong, he has to call the site and ask them to correct it. 



5: I told him I’d investigate this and give him a call 
later. He said to call him on Friday. 


10/4/2006 


AIL IHFOPmTIOII COIJTADIED 

HEEEIir IS rajCLASSIFIED 

DATE. 06-04-2007 BY 65179DHH/E3R/LHF 



Page I ot 1 



From: Help.Desk 

Sent: Tuesday, November 05, 20025|11 PM 

Subject: Help Desk Submission - | 1 11/05/2002 1325 - | ~j b7 e 


DMW SUPPORT REQUEST/INCIDENT REPORT 


Help Desk Type: 

Call Type: 

Date of call: 

Time of call: 

Date call returned: 
Time call returned: 
Site calling: 

Software baseline: 
Site Contact: 

Callers phone number: 
Help Desk Engineer: 
Category: 


Regular Hours 
Initial 
11/05/2002 
1325 

11/05/2002 



b6 

hlC 


Problem Description: 

Some of the telecommunications providers that they deal with 
had indicated that they w ould be p roviding their feeds in a 
CALEA format from now on. I w anted to know what he 

needed to do to get his TIU ready to receive these feeds. 


Action taken; 

I explained that he needed to get in touch with ERF and find 
out the status of the firewall between the TIU system and 
the DCS3000 {the network interface on which the CDC would be 
provided) , I explained that at present it would be a 
security violation to connect the CDC from a 
telecommunications provider to the TIU system. 

He indicated that he would contact ERF concerning this 
matter and call us back to discuss the audio {CCC) portion 
of the connection as soon as he had more information on how 
it would be provided. 


Status : CLOSED 

Date/Time Call Completed: 11/05/2002 1350 
Control Number: 02- 


10/4/2006 


ALL IHFOPmTIOH- COlTAIHEr 

HEPEIM IS miCLASSIFIED 

DATE -06-04-2007 BY 65179DHH/KSR/LHF 



From; 

Sent: 

To: 

Subject; 


Help. Desk 

Thursday, October 31 . 2002 1 :23 PM 
Help. Desk 

‘ ^Submission- Site! 1-10/31/2002 0850-1 


I Help Pasiii S 


bb 

bvc 


DMW SUPPORT REQUeST/lNCIDENT REPORT 


Help Desk Type: Help Desk Pager 

Call Type: Initial 

Date of call: ' 10/31/2002 

Time of call: 0850 

Date call returned: 10/31/2002 

Time call rotnmoA- 08?5Q 

Site calling: [ I 

Software baseline: 

Site Contact: 

Callers phone numil 
Help Desk Engin^ 

Category: 


b2 

bb 


. fc.7C 
' b7E 


Problem Description: j^g 

I | iad noticed that he had been receiving pen b7c 

intorrnati on from the DCS300 0 for one of his lines overnight 
but that h | ^ad not recorded anything for 

the night. 


Action taken: 

First we had him print all of his running processes from the 
record server and fox them to us before rebooting his record 
server. When we reviewed the list of running processes 
everything was accounted for (including RS_Announcer and 
SSR). However, he was still not recording following the 
reboot. 


We^iscovered^hat^^ of his lines had a status of j 
I We checked the scheduling information 

'ana it dll app^i"W Ta^)e ok. when wc tried to 
disable/enable either of the lines we would get "Invalid 
host /channel pair specified" messages in the advisory log. 

We checked the channel values line ids, and enabl e status 
of the lines on the TTU and the! to verify 


b2 

b7E 


ALL IMFCIPIIATIOH COHTAIHED 

HEREIir IS UlJCLASSiriED 

DATE 06-04-2007 BY 65179DHH/K3R/LHF 



that they were in synch. We tried stopping and restarting 
thetiusrv. ■ 


Eventually we had to stop the tiusrv, and the n 
disobic/enable the lines on the l l of the sys tem. 

At t his point the status for both lines converted from I ~~l 
|___[id w hen we r estarted the tiusrv everything appeored to be 
working. r I made a test call and verified that the 
system was now recording. 



b7E 


Status: CLOSED 

Date/Time Call Completed: 10/31/2CX}2 1000 

Control Number; 02- 

□ 


2 



UNCLASSIFIED 

NON.RECORD 

HeJ I 

Here is the list of F numbers for the 2003 server licenses. 

1. Names of person(s) that will utilltiie these licenses (If known - if systems will be used randomly 
by various personnel, then just state as such). 

Various tech agents in the Field 

2. State whether licenses are for FBI Employee or Contractor use (breakdown the quantities if 
necessary). 

FBI Employee 

3. Li ^^ Property Number of each computer system that license will be used on. 

SSnSERVERHIGHB 
AY.)dS (18 KB) 

4. State whether computer system(s) is a server, desktop or notebook h 2 

Server 

5. State the enclave, Program an d/or network that the system is connected to [such as FBINET, 

■ SBUNET (formerly Internet Cafe). I I etc.), along with the system classification 

Unclass DCSNET 

6. Provide a justirication that identifies the business requirements for the software 
DCS- 3000 systems 

7. Provide the name of the approving official, title (at FBIHQ, must be Unit Chief or higher; for Field 
O ffices, must be the SITS or Lead ITS), and the Unit/Section/Division. 

uc T I 



— Original M wstaop — 

From: I If OTDl (FBI) 

Sent Tuesday. May 09. Z0 06 11:16 AM 

To; I K OTOKFBI) 

Subject FW: SBTTs Dell Server in Hlghb^ 

UNCLASSIFIED 

NON-RECORD 


b6 

b7C 


ALL BTFORHATIOM COHTAIHEB 

HEKEIIf IS OTCLA3SIFIED 

DATE 06-05-2007 ET 65179DHH/KSR/LHF 



UNCLASSIFIED 

NON -RECORD 



Here is the list you requested . If you need any more info . please let me know. 




UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 




(OTDHFBI) 

Subject: RE: win 2003 server image 

Important: High 

UNCLASSIFIED 

NON-RECORD 


](OaO) 


We are looking to purchase 30 of the Enterprise licenses bringing our transfer to 
$73,500. We wilt not be able to wait until a fter June 15th to purchase them, b6 

unfortunately. Do I need to touch base wit j | to get the informotion 

to transfer the funds? 

This is for bCS3000, which is on the major projects list. 


Thanks, 


n 

OTD/ESTS/TICTU 
(O) 703| 

(F) 703\ 


b6 

fo7C 


— Original Mess 

Fram: 

Sent: 

To: 

Subject: 


1[ ~T cITOD)(FBI) 

inursoav. wav iL 2006 6:18 


|(OTDXCON)f 
image ^ 


](OTO)(FBI) 


UNCLASSIFIED 

NONRECORD 


Are you looking for Windows Server standard or enterprise - and are those 
the only Microsoft products that you require? To save you some steps - 
Windows Server Standard is $754.14 per iicense . Enterprise is $2449.98 
per license . Note that these costs decrease by around 15% or so after 
June 15 (so if you are deploying after June 15th, you would probably want 
to be paying in our next anniversary cycie of the ELA). 

Also, as a side note, is this project on the FBI's list of major projects, 
which is required by the CIO and FBI executive management? 


— Original 


Sent: 

To: 

Subject 


Mes!|^ 


35TD)(C0N) 

■ ‘006 3:27 01. 

31)E 


UNCLASSIFIED 

NON-RECORD 


InODXFBI) 


Version No: Hardware Model: | 

Patch?: NO # of Hardware Purchased: 

Security Patch?: false Reported to DOJ?: false 

Manufacturer: 

# of Lie. Purchased: 

VENDOR INFORMATION: 

Name; .AliftAX l=NfiTNFFMN& CQRPORAT INSTA 
Contact Perso Version/Mo( 

Phone #: lAnnnfnr-tun^r: 

Web Address; Operating System: \A 


t^fi^RPORAT INSTALLATION LOCATION: 
I Version/Model No.: 
_jAanufacturer: 

Operating System: WINDOWS 2000 


Pimory Developer: 

Date Assigned; 
Acknowledged Date: 
Acknowledged By: 
Completed Date: 
Completed By: 

Testing and Comments: 
n/a 


Phone; 

Ext: 

Pass/Fail: 


APPROVAL INFO. 

APPROVED 6ROUP : APPROVED BY: APPROVED DATE: ACTION; 

SO REVIEW I I 01/17/06 13:40:28 Approved 


PENDING APPROVAL: 
Approval Comments: 


(01/17/06 10:51:08 1_ 
Support of DCS3000 


I f01/17/,Qfi j 0:4 


UNCLASSIFIED 



Estimated Purchase $:864.00 
Estimated # of Lie: 
Estimated # of Items: 75 
SOFTWARE INFORMATION: 
Category: 

Manufacturer: 

Version No: 

Patch?: NO 


Total Purchase $: 
Purchase Date: 


HARDWARE INFORMATION: 

Category: Workstation 

Manufacturer: AMAX EN CINEFRINS CORPORAT 

Hardware Model: | | 

# of Hardware Purchased: 


Security Patch?: false Reported to DOJ?: false 

Manufacturer: 

# of Lie. Purchased: 

VENDOR INFORMATION: 

Name: A MAX EN6INEERINS CO RPORAT INSTALUTION LOCATION: 

Contact Pers on; I H Version/Model No.; 

Phone #: | | Manufacturer; 

Web Address: Operating System: WINDOWS 2000 


Pimary Developer: 

Date Assigned: 
Acknowledged Date: 
Acknowledged By: 
Completed Date: 
Completed By- 
Testing and Comments: 
n/a 


Phone: 

Ext; 

Pass/Fail; 


APPROVED (5ROUP:r 
SO REVIEW I 


APPROVAL INFO. 

aannucr>.BXj APPROVED DATE: ACTION: 

01/17/06 13:40:28 Approved 


PENDING APPROVAL: 
Approval Comments: 


Justification/Comments: 
01/17/06 13:40:27 byl 


(01/17/06 10:51:081 
Support of DCS30OT 


(01/17/06 10:43:5^ 



From: 

Sent: 

to: 

Subject: 


3(0TD){C0N) 


Friday 2006 7:16 AM 

I IfOTD) (FBh 

Remaining Funds 


SENSITIVE BUT UNCLASSIFtED 
NON-RECORD 


Thank you 


c 


GTD/Ei 
(0)703 
(F) 703- 


\Tsmcvj 


be 

b7C 


----Original WtasHM 

From: I pro) (FBD 

Sent! Thursday. Mav U. 20 06 3: 08 PM 
TO! I ~ OTO)fCON) 

Subject: RE: UPDATE: Remaining Rinds 

SENSITIVE BUT UNCLASSIFIED 
NON-Rg C pRD 


[ j is preparing reqs for approx. $25000.00. 

Telecommunications Intercept and Collection Technology Unit (TICTU) 
Electronic Suiveillance Technology Section 
Operational Technology Division 


be 

Ib7C 


— Ori^nal Message — 


33TD)(C0N) 
■200611:10 AM 


Sent: 

To: 


1 lOTD) (FBI) 

(CON^ 

Subject: 

TJPDKTEniSRBIPBF^Tunds 


□ 


JfTO)(FBD 


be 

b7C 


Just on update from our lost meeting on Friday (/Way 5th). Below shows the progress: 


DCS600Q Services; 

$503,591 

-200.000 (BAE - 6S 12/13 type support - In process) 

$303,591 

-150.000 (AQC - Additional Support for DCS6000 - Added on existing Reg E002732) 

$153,591 

- 73,500 (Transfer to purchase Software Licenses for 0CS3000 \ \ HQ has no more $$ to 

purchase any more this year) 


All, nrroRHATioiir cowtaiije'd 

HEREIIJ IS OTCLASSIFIED 

DATE 06-05-2007 BY 6.5179DHH/E3R/LMF 


From: I IfornyroN^ 

Sent; , Tuesdav, June 27. 2QQ6 2:17 pm 

To: \ tOTOUCOW 

Subject: FY03 & FY04 Planned vs. Actual 


SENSITIVE BUT UNCLASSIFIED 
NON.RECORD 


FV03 

DCS5000 

Planned $17,000,000 
Actual $16,778,331 

0CS6000 

Planned $18,401,085 
Actual $17,953,301 

0CS3000 

Planned $4,154,638 
Actual $4,116,667 

FV04 

DCS5000 

Planned $11,220,000 

Actual $11,847,873 (plus another $6,502,830 from other Cost Centers) 
bCSbOOO 

Planned $17,000,000 
Actual $17,298,723 


DCS3000 

Planned $3,535,507 
Actual $3,525,469 


r 


1 


be 

bvc 


OTD/ESTS/TTCTU 
(O)70r^ 
(F)703^ 


a 


SENSITIVE BUT UNCLASSIFIED 
Tracking: Ryyiplent 


Read: 6/28/2006 11:13 AM 


be 

b7C 


ALL IIIFORHATIOH COHTAIiaED 

HEREIN IS U1ICLA33IFIED 

DATE 06-05-2007 BY 65179DHH/KSR/LMF 


Page 1 of 4 


Trip Report 

Date Submitted 2004-03-08 

Approval Status Approved 

Approved By 
Created By I 
Program | | 

Site Name 48 

Task Order (TO) » 04-07878-00406-000 

Equipment Order 

(EO)# 

R&M Ticket# 

Team Members | | 

Date Trip Began 2004-03-01 

Date Trip Ended 2004-03-05 

Purpose Trip taken t o support tes ting of One-way -push. Site POC was 

I T Uso met with | p n site. 

Trip Results 


Summary: 


Undated site's TIU froml 

1 1 

1 1 

j^alyzed site traffic to assure that 
S3000 was received by the TIU and 
Server. All testing successful. 

ail CDC received by DC 
ultimately by the Record 


Detailed Report 

Monday, 2004-03-01 


fo2 
lb 6 
b7C 
b7E 


be 

b7C 


b2 

b7E 


Flew fro Dulles to site. 


ALL IliTFCiPmTIOir COHTAIHED 

HEREIN IS DNCLASSIFIED 

DATE 06-05-2007 BY 65179DKH/K3I 


At this point there was still an alignment problem between 


10/4/2006 


b2 

b7E 




o 


Page 2 of 4 


Circuits and actual audio not found until Tuesday. 

Tuesday, 2004-03-02 


lidentified messages that were not received over 


I lad entered into thL 

f urther investigation and conveip] 
istdted in an understanding that! 


I pd 1 ran through all the logs for the prior night, and 
'wnffThe exception corrected above, found that all sessions 
were recorded and contained all of the expected CDC. 

I l and I then went back and compared the! logs vnth 

the sessions on the record server for 2004-0CTTand found 
that al sessions were recorded for this day also. 

I that r>r>f receivlug the audlo associated with 

th j 1 The re was still a mismatch between 

Circuits m Physical Port s j [ walked me through the 

changes t J t hat were required. 


I j yas pleased with workings of VU Meter and 

Live Test capability. 

Q oted that voice level inputs were very low relative to 
:vel. 

Wednesday, 2004-03-03 

Arriv ed before l~~l and entered alone as precoordinated as 
I needed to arrive late. 


I reviewed the All Subject Log and compared it to the 




Page 3 of 4 


Playback Directory. Everything was accounted for. All CDC 
was received in duplicate (at DCS3000, TIU Log and 
Telephony Log) which resulted in the sprnnd Release 
message creating its. own session! Contacted 

and new how to correct — * 



Discussed results witlT 
Both seemed satisfiedr 


h'2 

bb 


b7E 


Spent some time demon strating new featu res and providing 
pmp miniiaj^ training t( f j Site Operations) and 

Thursday, 2004-03-04 

Personal day. 

Friday, 2004-03-05 

Return trip to Dulles, VA. 

Requested Changes 

The following enhancements were suggested. I indicated that 
I would note these but that they should be submitted through 
proper channels also. 


• I hould very much like a displayed linear 

TTraTirnrcne Analog CCCs in addition to for instead of) 


the Phvsical Port IDs. 



1 beam raised the CCC/CDC correlation issue 


associated with the lack of a unique CCC ID for certain 
inputs. 


I ^ d I were both very frustrated that the VU Meter 
only works if there is a connection fromm the TIU to 
the Record Server. If you are using the VU meter to 
find a signal amongst many imused inputs it is useless. 
This is exactly the case we had and we have a real need 
for this in diagnosing problems. It is not reasonable to 


b2 

be 

b7C 

b7E 


b2 

10/4/2006 




Importance: High 


SENSITIVE BUT UNCLASSIFIED 
N-QNr BECQRD 


I pSS5'§a This RMS to your group. 

This should be handled as expeditiously as possible. 


RMS 101411 -Omaha Division is requesting a | [m odel 

after reviewing a communication which indicated it \& th^ only ^pprovbd KVM to be 



KVM will connec t to both the FISA and Criminal DCS3000's and will replace the existing KVM 
which is made byj | Thank You! 


b2 

b7E 



SENSITIVE BUT UNCLASSIFIED 


ALL IIJFOPHATIOH COIifTAIIED 

HEREIIT IS tllJCLASSIFIED 

DATE 06-05-2007 BY 65179DHH/K3R/LHF 
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Message 


Page 2 of 3 


□ 


Thanks for getting the new circuit in. Re your other questions, 

1. We are still scheduled for October 3. 

2. The only DCS equipment I wouldn't mind help with is the DCS5000. I have ordered lines in St Louis 

and will be transfemng my FISAs there temporarily so that we don't lose any data, so there is not a big 
huny to get my system running, and we can physically move the system there, but 1 wouldn't mind having 
Raytheon get the stuff running again. But this can happen later in October, when things aren't as hectic, as 
St Louis will be collecting. i i 

3. I don't know whether or not the T1 cable has been run already | j yas out but J don't know what all 

they did. Is it any big deal running the cable? If not we can do it ‘ ^ 

4. I would love to have rack-mounted OCS3000 if that works out. 

5. Our new office is about 4 miles from the old office. 

Thank a^ I aIso. FYI, I won't be here during the move (Pakistan 9/30-10/10; BAE annual conference 
10/12-18) so if Raytheon comes out it probably should be after that 



Got a few questions for you; 

/Vre yall still on schedule to move on Oct 3? Will you need help moving the DCS equipment? Will 
you need any help running the T1 cable to the equipment room? Will you need rack mounted 
equipment for the new space? About how far away is the new office? 

Please let us know how we can help. 


thanksi 







Frod l(NO) (FBI) 

Sent: Tuesday, October 11, 2005 12:50 EM 

Tn. I _ ^OT^^^PRTM 

I hO)(CON)| lfOTD)(CON)l 


(Q-iP)ffp))| , J(QTD) (FB 

Cc:| pTD) (FBI] 

Sub lec^:RK:NOSitrep ^ 


r oTD)(FBi;| 
3TD) (FBI) 


UNCLASSIFIED 

N 0 N=SEGQSD 


Prior to making the decision to leave the ) | n place, we spoke with Raytheon and somebody from CSOC 

{or whatever its called now) and all said B laSVS II for it would be safer to leave than move. So that is what we 
did. Currently the closest place to put it would be in a warehouse in Baton Rouge, so for security purposes, etc, 
in my opinion it is best to leave it where it is. 


Technical Adviso r. New Orleans 


— O riginal Mgaage — 

From; r b TD) (FBI) 

Se nt: Friday, October 07, 2 005 1:04 PM— 
To; l IfO TD) (FBI)|_ 

(CON)I , , . ko) (FBI);r 

^conH Rotp) rEBlE 

Cc:| riTD) (FBI)J 

Su bject; fek:Nd 5 ifre p ' 


uNCLASsinep 

NON-RECORD 


We need to discuss the removal of the ! [ system from toe NO site. I spoke tol INO) 

yesterday. He informed that the workstalions have been removed from the site affftrstoretrBlSSwhere. but 
the system is still intact there in the CMP. It is powered down and wrapped/covered with a plastic tarp. 

Do we want to send a crew down to remove the system (preserve the hard drives, etc.)? Do we want to 
have it shipped here to ERF, to another site? ???? 


Program acmagar ■ Enterprise Operations Servtca 
Elsur Technology Management Unit (ETTMU) 

• Electronic Surveillance Technology Section (ESTS) 



HEBEIII IS TJHCLASSIFIED 

IJATE 06-0.5-2Q07 B¥ 65179DHH/K3R/UIF 



Message 


Page 2 of 4 


Cc;| |ITD) fFBn l I fO TD^ (CDfii ifFTPy 

fFBlI IrOTDUFBI^ i ^ fOTD^ (CON)j | 

(OTD) (FBI);| lifOTD) fFBi M I OTP) (FBI) 

Subject: Rt: IMU bitrep 

UNCLASSIFIED 

NON-RECORD 

Q b6 

the Houston office closure during hurricane Rita I installed a DCS 3000 in the Shreveport RA ^ ?c 
and prepared the VB III for a pending case. The system is prepared to collect for New Orleans if 
need be. As far as the T-50 systen^ 1 am \«aiting to see what NO decides to do. We will be sure to 
be available to install the system and get it going for them when they are ready and know where its 
going to be. When I have any further updates I will be sure to include you in the communications. 

We really dodged a big one by Rita going through SE Texas instead of Galveston and Houston. 


O) 

0 - 1 } 


Blsur Technology Management Unit (ETMU) 
Electronic Surveillance Technology Section (ESTS) 



Do we have any more info on the New Orleans status? 
Have we recovered/evaluated the DCS 5000? 

Do we anticipate a temporary requirement in Baton Rouge? 

Any other info??? 








(HO) (CON) 


Page 3 of 4 


(FBI)^ 

SubjeETTFWrWD^ 
Importance; High 


|NO) 

J(TICTU) (FYl) 


RE; DCSP Support 


FYt, I b ut of the Houston office) has evacuated Houst on because of 

RITA'S path, and is now in the Shreveport RA. His cell phone # i st I 

His cell phone coverage is spotty but you should be able to call the RA directly to 
locate him. He can be available to assist in checking out CMP collection systems 
equipment and/or relocating the equipment out of the NO office. All this said, you 
may have already been in contact with him, so i'll leave it in your hands, jluqilb^c 
anw fi.rfhor or more, assistance, please don’t hesitate to email or call an d T 
I r myself will see that you get it 


Elsur Technology Management Unit (ETMUj 
Electronic Surveillance Technology Action (ESTS) 
Operational Technology Division (OTD) 


— -oriqlp^t — , 

From I l lTD) (FBI) 

Se nt; Monday, Septemb er 12, 2005 4:^R PM 

Tni inmt fFBIV. i r OTOI (CON)j 

^Cc:| ' ' TtNO) (FB?f^ n^rro) (FBI) 

Sul lject-mV ' l^gSifre p * ' 

UNCLASSIFIED 

NON-RECORD 

Heads up that a request for DCSP support in NOLA/Baton Rouge will be coming. 
—-Original Message — 

From:| PVO) (FBI) 

Se nt; Monday" S^terriBer U . 2005 3:32 PM 

3* ioTD)JS?P^ nuD) (FBI): r 

CMISl I MG) 


Would ya'll forward this to whom ever you may think needs it especially in the TICTU 
realm. Tomorrow, space management and FBI movers will commence moving all of 
our TA/ET/CMP equipment from New Orleans to our new offeite located at an 
abandoned car dealership in Baton Rouge. This includes moving all CMP equipment 



Message 


fage 4 ot 4 


(Voice Box, DCS3000. | | 

During this move I am sure mmgs win oe damaged. We cannot leave anything in 
place for space management is to begin gutting our entire field office next week. In a 
perfect world, we will be back in our New Orleans office by the end of May, or early 
June '06. In the interim our division will be scattered in bldgs from Covington, LA to 
Baton Rouge, w ith Baton Ro uae having several bldgs housing different programs. I 
have asked TTA I ftp contart TICTU, et al to help set up temporary DCS 

3000, etc in our Shreveport^. As for as any CMP down here, I do not know at this 
time how that will evolve, but once we get all equipment up here in BR, perhaps BAE 
could send some contractor types to check out all of our equipment. Also, I am sure 
we will have to surplus equipment but we wilt take it one step at a time. 


b2 

be 

b7C 

b'7E 


|- 1 may ask for a few TTAs in the next week or so to come and help set up our 
>ace. There is a TR# associated with this that I will get for you if/when needed. 
Lodging is still an issue and anyone who comes should be prepared to sleep in TRU 
tents (A/C'd) or in our new space on cots. Just let those interested in coming what the 
conditions are. I will speak with you more on this when the time comes. I am the only 
TTA in NO that did not have significant damage t my house. All others are out til at 
least 10/1 on admin leave. 


That’s it for now. I'll keep you posted. 



UNCLASSIFIED 


UNCLASSIFIED 


UNC USSIFIED 


UNCLASSIFIED 


UNCLASSIFIED 


0/4/2006 


b2 

b7E 



From| |(OTD) (CON) 

Scjt- FriHav Tnlv m lOOS | 

I IrAVnWFkiVJ i fQTri^rt^RT):[ 

Cc J r OTDl fcokl 

Subject: RE: PDF Copies of your documents 


H)(FBI)| I 

IHKFBfJ ' 


SENSITIVE BUT UNCLASSIFtED 
NQNrBICQED 


I , piece of gear that was connected to &ie portable and DCS3000 was the On e-Wav Push. 

Remove all components of the One-Way Push and store them in a safe place unt i i x>mes down to 

reinstall on your new system. The portable should be packed up and shipped to Raytheon as soon as possible - 
sorry we didn't get the portable packed while we were there. 


TICTU Support Contractor @ ERF 
BA ^ Systems |n formation Technology 


Or iginal Message 

From; ! ~b TD^ (CON) 

Se nt: Tbursdav, 3une 30, 2005 12:0 9 PM _ 

TodIZIZIZDCeH) fFBIti IfOTPt (FBI)I |dTD) (FBI) 

Cc: 1 r OTDt (CON) 

Subject: RE: PDF Copies of your documents 

SENSITIVE BUT UNCLASSIFIED 
NQN-REeQ8D 

j I 'm copying |" b efore I call you back as I have no idea w hat the piece of eq uipment is 

mat you are referring to. I'll either get some enlightenment and call you back o| ivill call 

you back. iv 


r RHI (FBI) 

ie 30. 200 5 11:17 AM 
l (OTD) (CX)N) 
spies or your documents 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


PS leav ing. I remembered a while back that a piece of equipment was installed on our 
jl do bel ieve that its purpose is to push Pen Data from our DCS-3000 to our 


,to set up a time for this system to be moved to our new one. Please contact me atT 


ALL IlfFOPHATIOir COHTAIHED 

HEREim IS OTCLA331FIED 

DATE 06-05-2007 BY 65179DHH/K3R/LHF 
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Message 


FromJ 

loTD) (FBI) 


Sent; Thursday. September 



To 


__rOTD) (CONJ 


Cc 



b.TD.)./FBl)j 1 


1 

1 

luDIlIlIi] ■■ 



rOTDUCQN):[ 


(OTD) (CON)j~ 

Subject: RE: RW arid VB Systems 


SENSITIVE BUT UNCUVSSIFIEP 

nqn-becqbb 


J)TD)(CON);[| 


J;OTD)(CON) 


^copied a message from the TA (| 
their current situation; 


^in New Orleans which will provide an update of 


be 

bvc 

b7E 


Would ya’II forward this to whom ever you may think needs it, especially in the TICTU realm. Tomorrow, space 
management and FBI movers will commence moving all of our TA/CT /CMP equipn^nt from New Orleans to our 
I , I This includes moving all CMP equipment 

' WdICS BOX. OC'bintJlj | I ' 

During this move I am sure things will be damaged. We cannot leave anything in place for space management is 
to begin gutting our entire field office next week. In a perfect world, we will be back in our New Orleans office by 
the end of May, or early June '06. In the interim our division will be scattered in bldgs from Covingtonj_^jo___^ 
Baton Rouge, with Baton Rouge having several bldgs housing different programs. I have asked TTA I _ I 
to contact TICTU, et al to help set up temporary DCS 3000, etc in our Shreveport RA. As for as any CMP down 
here, I do not know at this time how that will evolve, but once we get all equipment up here in BR, i^rhaps BAE 
could send some contractor types to check out all of our equipment. Also, 1 am sure we will have to surplus 
equipment but we will take it one step at a time. 


IriQlnal Messaoe- 



Su6ject: FW: RW and VB'Systems 


^OTD) (CON) 
22, ?nn »; am 
(OTD) fFBl l 


(OTD) (CON);[ 


UOTD) (FBI);[; 


](OTD) (FBI); 


]OTD) (CON) 


SJN.SITjyE_BqT UNgL AS^ IFI E D. 
NON-RECORD 


FYI 

— -Original Message 

From i I fOTDVCON) 

Sent; Wednesday, September 21, 2005 1:29 PM 

i.v'. (FBI); | 1 (OTD) (CON) 


NON-RECORD 


ALL nirORHATIOir COHTAIHED 

HEKEIIJ IS OSrCLASSIFIED 

DATE 06-05-2007 BY 65179DHH/K3R/LHF 


b6 

b7C 
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b7E 
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DCS6000/Digital Storm 

System Security Plan 
(SSP) 


December 16, 2002 

Version 1.3 -December 16, 2002 


I Ptenarftd.Ear | 

Chief, Information Technology Security Unit (ITSU) 
Federal Bureau of Investigation 
935 Pennsylvania Avemie. NW 
Room 9483 

Washington, DC 20530 


he 

hlC 


Prepared By: 
The ITSU Team 
FBIHQ 


ALL lUFORmTIOir COUTAIHED 

HEREDI IS DIJCLASSIFIED 

DATE 06-05-2007 BY 65179DHH/K3R/LHF 
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3.1.1 Clearance/Sensitivity Levels 17 
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3.2.1 Physical Access Controls 21 
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1,6.4 Accreditation Boundary 

The DCS6000A^ oiceBox III may use it as a stand-alone system or in conjunction with the 
DCSNET and DCS3000 CALEA-corapliant system. The telephone I’mes connected to 
this system are passively monitored by FBI personnel for the collection of Title III 
evidence and cannot be used to alter the telephonic digital data received or to penetrate 
the systems themselves. With this in mind, the accreditation boundary for both Digital 
Storm and DCS6000 envelops all Digital Storm/DCS6000 system hardware and software 
but does not include the telephone lines that are to be monitored or the DCSNET and 
DCS3000. To increase the security and isolation of the Digital Storm/DCS6000 from the 
DCSNET and DCS3000, a Cisco FIX Firewall is installed within the boimdary of the 
Digital Storm/DCS6000 network. The firewall is strictly configured to only allow access 
to tlie VoiceBox Recording Workstation for the purpose of retrieving CALEA data from 
service providers by way of the DCS3000 network and for management in the updating 
of anti-virus definition files provided by the DCSNET network for the McAfee 
VirusScan software. In addition utilizing the secure DCSNET as a conduit the firewall is 
strictly configured to allow access to the VoiceBox Server for remote administration by 
the NetOp Host/Guest application. This configuration will restrict remote administration 
to the specific IP addresses of designated guest machines and the specific TCP ports for 
the application. This remote administration application is used mostly by ERF personnel 
to support the various DCS6000 systems deployed tliroughout the country in the field 
offices and resident agencies. Additional locations as designated by ERF management 
may be configured to allow remote administration by privileged users within a field 
office to maintain multiple systems within their area of responsibilities. The following 
figure generally depicts this accreditation boundary. 
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hacker methods. Such an effort would not only be highly risky and time-consuming but 
also be easily detected. 

As with most information systems, the greatest threat to the DCS6000/Digital Storm 
would come from the inside. Users, who have access to the system at various levels, 
could damage, alter, or erase data and destroy system hardware and software. They also 
could use the information gathered by it for profit by passing on the collected information 
or by alertiiig those being monitored. Fortunately, the FBI people involved in Title III 
cases have undergone a very thorough screening process in order to work for the FBI, and 
many of these same people are involved in one way or the other in closely monitoring 
their own Title III operations, 

1.8 System Interconnection/Ittformation Sharing 

Digital Storm/DCS6000 is connected to the DCSNET and DCS3000 networks for 
CALEA compliant data and as a conduit to allow remote administration by designated 
personnel. 

1.S.J Sensitivity of Information Handled 

The information processed by the DCS6000 and Digital Storm ranges from unclassified 
to sensitive-but-unclassified (SBU). No classified information is processed by these 
systems. 

1 . 9 Applicable Laws and/or Regulations Affecting the System 

In addition to the numerous laws, regulations, and policies listed (i.e., subsections 1 .9. 1 
and 1 .9.2 immediately below) that influence the operation and modification of all current 
information technology (IT) systems and the development of new ones, the development 
and operation of the DCS6000 and the conduct of those persoimel who are part of its 
operation, have been, and \vill continue to be, rigidly controlled by the mandates of 
United States Code 18, Crimes arid Criminal Procedure (i.e., 18 USC 2510 et seq., 2701 
et seq., and 3 121 et seq.). Virtually every activity ^sociated with an FBI electronic 
surveillance operation is performed with these requirements firmly in mind. This system 
and the people who operate it must comply vnth ^1 the legal requirements that this code 
stipulates for the conduct of every aspect of FBI electronic surveillance operations. 
Moreover, the system was developed with a set of security policies integrated into it that 
help enforce compliance with those requirements during its operation. Finally, the 
personnel who participate in the operation of the system are closely monitored to ensure 
they comply with this code. These inherent security components of the DCS6000 system 
itself and of its operation collectively provide an additional layer of information security 
that is not present for the operation of most other IT systems that handle SBU 
information. 



LIMITED OFFICIAL USE ONLY 

<OTHER out of scope 

PG-5 





LIMITED OFFICIAL USE ONLY 



LIMITED OFFICIAL USE ONLY 


PG-6 






Federal Bureau of Investigation 

Operational Technology Division 
Telecommunications Intercept and Collection 
Technology Unit 



Data Exploitation Conference 
January 2006 


ALL IITFOPHATIOH COHTAIHED 

HEREIJr IS OTCLAS3IFIED 

DATE OS-OS-2007 BY 65179DIIH/KSR/LHF 
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DCS 3000 - Switch-Based 



> CALEA Based Intercepts 

> Develops, procures, and deploys capabilities to perform pen- 
register, Title III, and Title 50 interceptions on emerging 
telecommunications networks 

> Separate Call Data Channel (CDC) and Call Content Channel 
(CCC) 

> Single Data Channel for Multiple CCCs (and Multiple Pen 
Register operations) 
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From: Help.Desk I 37 - 

Sent: Thursday. December 19, 2002 6:01 PM 

Subject: Help Desk Submission - Site 24 DN - 12/19«002 15:50 -I I 


DMW SUPPORT REQUEST/INCIDENT REPORT 


Help Desk Type: 

Call Type: 

Date of call: 

Time of call: 

Date call returned: 
Time call returned: 
Site calling: 

Software baseline: 
Site Contact: 

Callers phone number: 
Help Desk Engineer: 
Category; 


Regular Hours 

Initial 

12/19/2002 


15:50 

12/19/2002 



b2 

b6 

b7C 

b7E 


Problem Description: lb 6 


Action taken: 



b2 

b7S 


lb 6 
b7C 


He also asked if there_^s_arr^^^e£ortthat would include the comment field. I told hi 
He said he'd get wtt | fc garding their requirement. 


leiTOTIOlI COHTAIMED (^^OSED 

HEREBI IS THJCLAS3IFIED 
DATE 06-05-2007 BY 65179DHH/K3R/LHF 

Date/Tiine Call Completed: 12/19/2002 18:00 


10/4/2006 



Unit: TICTU 


FY2006 Spending Plan 

Base Level Funding 


Account 

Brief Spend Plan Description 

Remaining 1st 
Quarter 

2nd 

Quarter 

3rd 

Quarter 

4th 

Quarter 

Total 

573000JM 

New equipment & upgrades for digital Qectronic Surveillance (ELSUR) 
collection supporting Title III requirements. Collection systems include 
DCS3000, DCS6000, and Traditional techniques (i.e. dialed number 
recorders, fax, and analog/digital recording equipment). Vendors 
include JSI, ETI 

$3,836,408 

$328,641 

SO 

$0 

$4,167,049 

5525-6JM 

Research & Development of new technologies and capabilities. 
Contractor support and services for Installation, system administration, 

. user support, and quick reaction problem resolution of deployed ELSUR 
systems. Ensure quality assurance through test and evaluation, data 
analysis, and training. Vendors include Raytheon, Pitney Bowes, ETI 

$660,000 

$440,000 


$0 

$1,100,000 

5-2S15JM 

Maintenance of fielded DCS6000 systems and fax Intercept and 
collerdion equipment Funding used for hardware maintenance and 
repairs, as well as software upgrades. Vendors Include 

$30,000 



$0 

$30,000 


Supplies to support ongoing purchases, installs, repairs, maintenance 


5626-1 

of all collections systems. Bank One 

$65,000 

$47,312 

$0 

$0 

$112,312 


TOTAL - TFSSiS 




L 

$5,409,361 1 


Totals must match the Revised Amount Available column from the Balances sheet. 


AIL IIIFCPHATION COFTAIHED 

HEREI5T IS OTCLASSiriED 

DATE 06-07-2007 BY 6S179DHH/K3R/LHF 
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Unit: TICTU FY2006 Spending Plan 

Base Level Funding 


Account 

Brief Spend Plan Description 

Remaining 1st 

2nd 

Quarter 

3rd 

4th 

Total 

573000IC 

Surveillance Act (FISA) Digital Collection Systems supporting National 
Security ELSUR requirements. Collection systems to Include 
DCS3000, DCSSOOO, and Fax Intercept. Vendors Include Raytheon 
($3,830,703), VMWare ($580,000), and various commercial companies 
including Dell, Hewlett-Packard, Cisco, Compaq ($129,800) in 1st 
Quarten variuos commercial vendors including Dell ($13,800), Cisco 
($92,280), TBD ($535,575) In 2nd Quarter, and Raytheon ($2,388,845) 

$4,513,503 

$641,055 

$2,388,646 

$0 

$7,543,804 

552MIC 

maintenance and repan" of deployed systems. Research and 
Development of new technologies and capabilities. Contractor support 
and service for Installation, system administration, user support, and 
quick reaction problem resolution of hardware, software, and network 
problems. Vendors include BAH ($600,000), Windermere ($250,000), 
and Oracle ($75,000) in 1st Quarter BAE ($1,250,000) in 2nd Quarter; 
and Raytheon ($2,285,000) In 3rd Quarter . 

$925,000 

$1,250,000 

$2,285,000 

$0 

$4,460,000 

5-2508IC 

552S«IC 

Special training for DCS5000 System Administrators and Operators. 
Also, system maintenance training. Vendors Include Raytheon $50,000 
each In 2nd and 3rd Quarters). 

$0 

$50,000 

$50,000 

$0 

$100,000 

5-251 SIC 

Maintenance of fielded DCSSOOO Systems. Funding used for software 
upgrades. Vendors Include Raytheon ($4,150,000). 

$0 

$4,150,000 

$0 

$0 

$4,600,000 

5-2520IC 

Maintenance of fielded DCSSOOO Systems. Funding used for hardware 
maintenance. Vendors include Raytheon ($600,000). 

$0 

$800,000 

$0 

$0 

$600,000 
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Supplies to support ongoing purchases, Installs, repairs, maintenance 
of all collections systems. Vendors Include Raytheon and other 

5628-1 1C commercial companies to be determined. $75,000 

TOTAL - DTP 


Totals must match the Revised Amount Available column from the Balances sheet 


Please provide a brief description of your FY06 accomplishments to date: 




FISCAL YEAR 2003 UNIT SPENDING 

ELECTRONIC SURVEILLANCE PROGRAM 


Program Goal; To develop, procure, and deploy rapabOtUes to auppoit efflclent manasement and sharing of intercepted Intelligenea and evidence In support of 
the FBI's Informatlan Sharing Initiative through the development of a Digital Collection Infrastructure. 



D6 Digital Collection Infrastructure (DCSEOOO) 9,000,000 10,000,000 

Purchase, training, and InstallaUon of DCS6000 systems. 

DCS6000 systems provide digital ELSUR collection and 
minimization capabilities for telephone and micraphone audio 
collection and will replace existing analog cassette recorders. 

Fiscal year 2003 funding will be utilized to purchase 20 systems. 

These systems support Criminal Investigative Title III requirements. 

New Equipment & Upgrades _ 

TV D6101 DCS6000 Collection Systems 4,600,000 4,SSS,000 JM 10,000,000 10,000,000 1C 


Maintenance offiaidedDCSeoOO systems. Funding will fas 
used for hardware maintenance and software upgrades to 18 
JSI VoiceBox systems. These systems support on-going Tids 
III investtaatlons. 

JB D6201 DCS6QQ0 Infrastnicture and Integration Support 1,300,000 1,300,000 552SStUM 

JB D6203 DCS6Q00DCSP 1,600,000 1.600,000 ssasmjM 

TV D6204 DCS6000Aoquisition& Planning 1,100,000 1,033,192 sszssojM 

KB D6205 DCS30Q0/CALEA Compliance 400,000 400,000 sszssojM 


OS Digital Collecdon Infrastructure (DCS-5000) - 20,600,000 

Purchase, training, and upgrade of the FSTs Foreign 
Inteingence SurveDlance Act (HSA) DIgitai CoUectlon Systems. 


DECLASSIFIED BY 6Sn9DHH/KSR/LKr 
OH OS-07-2007 
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Fiscal Year 2003 funding will be used to bring these systems Into 
compliance with CALEA through the punchase and instaliation of 15 
OAUEA-compliant telecommunication interface boxes to support 
FBI field offices. This Digital Collection Platform supports 
counterintelligence and international terrorism investigations. 

TV 05101 DCS-BOOO Systems 10,660,000 4,^,5S4 1C 


Maintenance of Foreign Intelligence Surveillance Equipment - 
Digital Collection Systems. Funding will be utilized for the 
vendor help desk and on-site technical support of deployed 
DCS5000 and Digital Multimedia lAbtchdog (DMW) Systems. 
DCS5000 and DMW systems support counterintelligence and 
international terrorism invesdgadons. These syslams are 
deployed In the Held and support National Security ELSUR 
requirements. The Raytheon DCSSOOO system Is currently 
deployed In the New York and Washington Reid Offices. The 
DMW system is currently deployed in 49 locations and 
provides for 80% of the Counterintelligence Division collection. 
It Is essential to provide contasctor support to resolve 
hardware, software, and network problems. These systems 
support National Security Investigations. 


JB D5201 DCSSOOO Infrastructure and Integration Support 

TV 06202 System Maintenance 

JB D5203 DCSSOOO DCSP 

TV D5204 DCSSOOO Acquisition S' Planning 

KB D52Q5 DCS3000 

TV D5206 DCSSOOO Training 


950.000 950,000 ssaseoic 

4.060.000 1,056,699 saasinc 

1.300.000 1,300,000 SS2SS0IC 

1.200.000 7,678 SS2BS0IC 

2,000,000 2,000,000 sstssac 

360.000 - ssznaic 


Digital Collection Infrastructure -Collection Analysis 
OCE Digital Collection Enhancement 


600,000 
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FY 2005 TFSS "Snapshot” Spending Plan 
Telecommunications Intercept and Collection Technology Unit 
Budget Item JM 
S 18,532^2 


Initiative/Project Name: DCS6000 

Description: The DCS-6000, also known as Voice Box III, is the FBI's enterprise system for 
Criminal Law Enforcement (CLE) collection of digital evidence. DCS-6000 collection systems 
They consolidate a wide variety of functions formerly performed by several separate systems. 
DCS-6000 systems are configured to support a wide variety of collection requirements such as 
voice, microphone, fax, and modem intercepts. These systems will also collect and record input 
signals from a variety of C ALEA J-Standard sources. Functional capabilities of this system 
include; audio collection and storage subsystem(s), interception of inputs from various 
telephone and microphone sources, extraction of dial number recorder (DNR) data, audio 
monitoring and minimization control, recording of audio and DNR evidence, and 
playback/demodulation of intercepted data for summarization and transcription. 


Project/Initiative Resource Allocations | 

Category 

FY 2004 
Allotment 

FY2005 

Allotment 

Projected Outyear Costs Through 
Completion 

Equipment 

Systems 

Upgrades 

$500,000 

$500,000 

$2,500,000 

Services 

System Maintenance 
CMP/EOSO 
On Site 
Infiastructure 
Acquisition/Planning 
DCS-3000 Support 

$2,750,000 

$2,411,300 

$1,588,700 

1,250,000 

$500,000 

$2,750,000 

$2,411,300 

$1,588,700 

1,250,000 

$500,000 

$13,750,000 

$12,056,500 
$7,943,500 
. $6,250,000 
$2,500,000 

Parts and Supplies 

$112,312 



Total 

$9,112,312 

$9,000,000 

$37,056,500 


Status: The DCS-6000 Project Team continues to evaluate, select, acquire, deploy, and maintain 
digital audio collection systems and to provide enhanced investigative capabilities in response to 
field office requirements and requests. Advances in collection technology and capability, 
proposed by the system manufacturer, are pleinned for future system upgrades and enhancements. 

DCS-6000 systems are currently deployed in each of the FBI’s 56 field offices and 29 resident 
agencies. During FY04 1 4 systems were installed which included and 4 system upgrades were 
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completed. Project plans for FYQ 5 the deployment of 10 syste ms and system upgrades to at 2 he 
following additional functionality: ! j work flow management, CAL'b''E 

support enhancements, and additional training. 

Impact: The DCS-6000 provides an efficient and effective consolidation of functions and 
system capabilities into single systems ensuring cost savings and permit beneficial use of 
program resources, such as, personnel, facilities, and equipment for consolidated training, 
operational, and maintenance activities. DCS-6000 systems benefit the field offices by providing 
an improved evidentiary record, automatic report generation, and portable evidence storage. 
These systems consolidate existing collection capabilities into a single system with multi-line 
collection, monitoring, recording, and playback capabilities. A primary goal of the DGS-6000 
systems provided by this project is to provide the end user with a more efficient process to reduce 
tirie time required to identify, review, and traiKcribe pertinent audio information. The collection 
system’s electronic formats also allow for the data, reports, and analyses to be easily used in 
collaborations with FBI partnering agencies, foreign governments, and institutions when 
necessary. 

FY 2004 Accomplishments: 

- Provided timely and accurate support to all 56 field offices in response to requests for 
assistance with the DCS-6000 digital collection system. 

- Deployed 14 VoiceBox III Digital Collection Systems which include 4 rack upgrades, 3 
portable systems, and 7 fixed site systems 

Initiative/Project Name: DCS3000 

Description: The FBI uses the DCS-3000 system to accomplish all Communication Assistance to 
Law Enforcement (CALEA) based Foreign Intelligence Surveillance Act (FISA) colle ctions for 
electronic surveillance court orders including all wireless telephony an ^ [ intercepts. 

The DCS-3000 system, developed and implemented via in-house engiifeenfig, 15 a fintical 
component of the FBI's ability to collect foreign counterintelligence information. It correlates 
CDC and CCC which is crucial in the event that this information is later used in court. The 
requested funding provides dedicated engineering staff and resources to maintain the DCS-3000 
system. This support allows immediate response to changes in the telephony switching 
environment to ensure uninterrupted FISA collection for CALEA-b^ed intercepts by providing 
software and hardware enhancements to the DCS-3000. 


Project/Initiative Resource Allocations ] 

Category 

FY 2004 
Allotment 

FY2005 

Allotment 

Projected Outyear Costs Through 
Completion 

Equipment 

$950,000 

$1,000,000 


Services 

$990,000 

$1,000,000 


Parts and Supplies 
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Total 


$1,940,000 I $2,000,000 


$0 


Status: The DCS-3000 continues to support all CALEA-based FISA intercfints Tn FV 9005, the 
DCS 3000 system will be enhanced to support FISA intercepts o | | 

I plan for integrating the DCS-3000 CALEA system with the DCS-5000 FISA 

collection system was completed in FY 2004. The requested fimding for FY 2005 will permit 
this plan to be implemented. 


Impact: The planned DCS-3000 and DCS-5000 integration plan will provide the FBI with a 
better intelligence resource by coupling signaling information (i.e. pen-register data) with 
collection audio content collected from CALEA-based sources (e.g. all wireless telephony targets 
and cable telephony targets). 


FY 2004 Accomplishments: 


DCS-3000 to DCS-5000 Integration Plan completion and software enhancements. 
This effort developed a plan and necessary software to allow the connection of the 
classified DCS-5000 system to the unclassified DCS-3000 CALEA system. 
Completion of the DCSnet connectivity to all 56 FBI field offices. This secure, 
private network allows CALEA-based intercept data to be transported from any 
CALEA-compliant service providers intercept access point to any FBI field office 
in real-time. This network has sufficient bandwidth to su pport critical FISA 
collections of new and emerging communications such aj | 


Initiative/Project Name: Traditional Technologies 


Description: Using layman's termsj explain in roughly one paragraph exactly what equipment 
and/or services emanate from the project/initiative and how this project supports Criminal 
investigative requirements.] 


Project/Initiative Resource Allocations | 

Category 

FY2004 

Allotment 

FY2005 

Allotment 

Projected Outyear Costs Through 
Completion 

Equipment 

$2,200,000 



Services 

$30,000 



Parts and Supplies 




Total 

$2,230,000 

$0 

$0 
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6) Define the impact to those investigations if the initiative remains unaddressed. 
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Version 2.5 


Van Jraegration/DCS10-20c 

43 Configure the n 


Launch the| [application (a shortcut should be on your desktop after the installation). 

Verify the ^r ver sett in gs are correct by clicking on the Configure from the top menu in the 
I L itiHnw then choose Server Options. 



'■'i Target Configuralion Oplions 


4.4 Set the T arget Number(s) 




Software Installation and Users Manual 



Version 2.5 
September 1**, 2006 


Wireless Intercept and Tracking Team 
Tracking Technology Unit 


ALL WFORMTIOJL COHTAIIIE]) 

HEKEIir IS UNCLASSIFIED 

DATE 06-07-2007 BY 65179DHH/K3R/LHF 


KOI, 
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Individual Ticket Report 


Ate sessions running He is certain sessions ate not ninning together. All durations of 
together? sessions that are recorded match those of the DCS3000 


I mode. I explained that he wil l 
e made the change and will report back on the 


It is important to note that usin j lUnota 

know that we were working the correction to | | 

^onOpen«l caUType; CaUMalhod: 

I I Follow-Up Helpdesk Call 


s problem. I le j | 


Date Notified 

2005-01-28 

09:35:00 


Date of 
Response 
2005-01-28 
09:35:00 


Suspect this issue is tied to effort being conducted on Ticket 843-3425. Will proceed 
accordingly. 



Call Method: 
Helpdesk Call 


Date Notified 
2005-02-1 1 
08:35:00 


Date of 
Response 
2005-02-11 
08:35:00 


As indicated in an earlier action, suspect this issue is tied to effort being conducted on Ticket 
843-3425. Will proceed accordingly. 


Action Opened 




Aaaai Dotc Notificd 

Call Type: Call Method: ^ . Response 

Follow-Up Helpdesk Call fn « nn 2005-04-04 

I iu.53.uu 10:53:00 


I talked t d I rd we belive that the I fc orrect their problem. 

Since this baseline is in the process of being distributed and installed on fielded systems we 
have to wait until it is installed at this site to see if it will solve their problem. 


I left a message witli 


Ito let him know that we had not forgotten their problem and 


10/4/2006 





inawuiual l icKet Report 


Page 1 of 4 


Monthly 

Downtime 


Ticket 

Number 


Site System 


g^stera U 

Warranty Exp Response Closed 


2005-10-02 


Date of Date Ticket 

Response 

2005-04-05 2005-04-05 0000-00-00 


12:20:00 


12:20:00 


00:00:00 


Problem Description 


i dicartes this is a follow-up from call 


JiW itchita) tc| form some 


Hardware Issues 

• Malfunction Description 

o 

• Failed Equipment / S/N 

• Replacement Parts 

o 

• Chargeable Time 

o 

• Additional Charges 


Action Opened . 

B2 


Call Type: 
Initial 


Call Method: 
Helpdesk Call 


POC Phone 

Site POC Number 

I I 


Action Taken 

Indicated would investigate witl j t nd call back... 


Action Opened 
Dk 


I spoke wit 


.Call Type: 
Follow-Up 

POC Phone 
Number 
cell - 


Call Method: 
Helpdesk Call 


Date Notified 
2005-04-05 
12:20:00 


Date Notified 

2005-04-05 

18:04:00 


Date of 
Response 
2005-04-05 
12:20:00 


Date of 
Response 
2005-04-05 
18:04:00 


DATE 06-07-2007 BY 65179DHH/KSR/LHF 

determined that they were having the same problemsr 


10/4/2006 


b2 

b7£ 


bfi 

bVC 


b2 

b7E 
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Individual Ticket Report 


He did have another problem that I indicated I will discus with our I l engineers as soon as 



I'm gomg to assign this to | 

Action Opened ^ 

** CaUType: 

| ”y I Follow-Up 

POC Phone 

Site POC Number 


Call Method: 
Helpdesk Call 


Date Notified 

2005-04-20 

14:06:00 


2005-04-20 

14:06:00 


er | j eguest, called ] [ back to find t he stafa ; 

:suii or meir discussions wlUl IfBJ Sfimce provider ] I 


call Type: 

“ 1 Follow-Up 


POC Phone 
Number 
cell- 


IS of the problem and what was the 


II n/i * 1 . ,1 Date Notified 

Call Method: onns na oi Response 

Helpdesk Call fo i nn 2005-04-21 

U.54.UU 12:54;00 



if this makes a difference. 


Date Notified Date of 


. 10/4/2006 












Individual Ticket Report 


Site 

# 





SALT LAKE 
CITY 

48 



Monthly 

Downtime 

0 

Ticket 

Number 

Site System 

System 

Warranty Exp 

Date Notified 

Date of 
Response 

Date Ticket 
Closed 

5-4839 



2004-01-05 

15:05:00 

2004-01-05 

15:10:00 

0000-00-00 

00:00:00 

Problem Description 






sending much more than what is collects 

Hardware Issues 

• Malfunction Description 

o 

• Failed Equipment / S/N 

o 

• Replacement Parts 

o 

• Chargeable Time 

o 

• Additional Charges 


Action Opened 
By 




Action Taken 


Call Type: 
Initial 


POC Phone 
Number 


Call Method: Date Notified 

Direct to 2004-01-05 

Engineer 15:05:00 


Call Type: 
Follow-Up 

POC Phone 
Number 


Call Method: 
Helpdesk Call 


Date Notified 

2004-01-07 

12:55:00 


Date of 
Response 
2004-01-05 
15:10:00, 



Date of 
Response 
2004-01-07 
12:55:00 


L 10/4/2006 




Individual Ticket Report 


rage z oi z 


Action Taken 


tar as the CALHA message issues, he collected some sessions on the 


destination log and was going to compare what he has with what the DCS3000 is sending. 

Date Notified 
12:16;00 ,2:16:00 


Action Opened urr 
1 Call Type: 

I I Follow-Up 


Call Method: 
Helpdesk Call 


Site POC 


Action Taken 


POC Phone 

Numbfif 


Reference ticket Number 2-1847. 


be 

b7C 


b2 

b'VE 


[ 


lb 6 
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Federal Bureau of Investigation 
935 Pennsylvania Avenue, NW 
Room 1302 

Washington, DC 20530 


be 
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1. INTRODUCTION 

The Data Collection System (DCS) 3000 application suite was developed to assist Law 
Enforcement Agencies (LEA) with collecting and processing data for Court-ordered electronic 
surveillance (ELSUR) operations. This system was developed, as ^ interim solution to Law 
Enforcement Agency collection needs until commercial collection platforms become available. 

1.1. Purpose 

The goal of this effort is to provide the Designated Accrediting Authority (DAA) with the 
information necessary to complete the security certification and accreditation (C&A) process. 

The C&A process validates that the required safeguards have been identified and implemented 
on the system. The culmination of this effort will be system accreditation (i.e. formd approval 
to operate) by the DAA. 

1.2. Background 

This security concept of operations (CONOPS) describes the planned operating conditions of the 
DCS3000 and the expected residual risk of operating the system. The system descriptions and 
security requirements provided herein are intended to assist the Designated Accrediting 
Authority (DAA) in determining the appropriate set of technical and non-technical safeguards for 
protecting the information in the DCS3000 system. 

1.3. Project/Program Overview 

The DCS3000 was developed by personnel from die Telecommunications Intercept and 
Collection Technology Unit (TICTU) of the Cyber Technology Section of the Federal Bureau of 
Investigation (FBI). The TICTU is located at the FBI Engineering Research Facility (ERF), 
Building # 27958A, Quantico, VA 22135. 

The DCS3000 has been in operation since 1997 and is operational in 55 of 56 FBI field offices 
across the United States. 

1.4. Assumptions 

The security requirements described in this CONOPS are based on the following assumptions: 

• The clearance process is adequate to reduce the risk of insider threat. 

• Adequate physical access controls are being implemented as planned. 

• Interconnected network elements outside the scope of this system are secured. 

2. REFERENCES 

This document has been prepared in accordance with guidance provided by: 

• FBI Certification and Accreditation Handbook (Draft), October 1 7, 2002 

• FBI, Manual of Investigative Operations and Guidelines (MIOG), Part II, Section 35 

• FBI, Manual of Administrative Operations and Procedures (MAOP) Part I, Section 259, 
Security Clearance Investigations 


1 
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3. CURRENT OPERATING ENVIRONMENT 

3.1. Current System 

To conduct court-ordered ELSUR operations, LEAs dial into switches that are devices used by 
telecommunications service providers to route telephone calls to their destinations. The 
DCS3000 can collect ELSUR data under the following warrant types: 

• Pen Register - limited to call data 

• Title III - limited to call data and call content 

• Cooperative Warrant - limited to call data and call content for phone numbers that do not 
belong to identified associates. 

3.2. Major System Components 

The DCS3000 suite consists of five component applications residing on one or more 
workstations. The components of the DCS suite used to support a particular requirement depend 
upon the type of surveillance to be conducted, the switch providing the data, the 
telecommunications service provider, and availability of equipment at the field office. The 
DCS3000 consists of the following applications: 

• Client 

• Server 

• MuItiServer 

• VANGuard 

» MultiVANGuard 

The Client 

The client is used to enter warrants, and to collect incoming call data and record call content in 
formats that are appropriate for use as evidence. Surveillance operations can be interrupted or 
closed fi’om the client. The client is required for surveillance operations unless these capabilities 
are performed via a third-party application such as a collection platform. 

The client may collect data within the following guidelines: 

• Support one Title III, Cooperative Warrant, or one] |collection and /or 

• Support multiple Pen Register collections 

• Connect to multiple servers or MultiServers (up to 35) 

The Server 

The server receives data from the switch and routes that data to the client. The server is the only 
application that can receive and route data fo | t ails. The server can support the following: 

• Multiple Title III, Cooperative Warrant, or | I collections 

• Multiple Pen Register collections 

• Multiple client connections 

• Cormection to one switch 

2 
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The MultiServer 

The MultiServer provides the same flmctionality as the server, except that it has the ability to 
connect to multiple switches. It is sometimes referred to as the Multiple Switch Server. In 
addition to multiple-switch connections, the MultiServer can support the following: 

• Multiple Title III and Cooperative Warrant collections 

• Support multiple Pen Register collections 

• Multiple client connections 


The VANGuard 

The VANGuard buffers data ffon j j vitches, and routes the 

data to the server or MultiServer. It enables field offices to collect data periodically, thus i 
on potential long distance charges. While multiple switches can connect to the VanGuard, the 
VanGuard can connect to only one switch. 


The Multi-VANGuard 

The Multi-VANGuard can buffer data from multipie r j witches. It can be referred to as the 
Multiple-Switch VANGuard. Like the VANGuard, toe Multi-VANGuard enables field offices to 
collect data periodically, thus saving on potential long distance charges. This application can, 
also, be used to monitor the status of current connections. Users can reset a connection if a 
problem is detected. The VanGuard can connect to up to 25 switches. 


3.3. User Organizations and Personnel 

In addition to cognizant system management and engineering personnel at the TICTU located 
within toe FBI ERF, other user personnel are found at FBI field offices throughout toe United 
States and Puerto Rico. 


4. SYSTEM OPERATIONAL OVERVIEW 
4.1. Networking Infrastructure 

The DCS3000 is connected to toe telecommunications service provider via TCP/IP. The 
connection can be established either by the DCS3000 or by toe switch. Data transmitted to toe 
DCS3000 in support of Title III, Pen Register, or Cooperative Warrant collections is sensitive- 
but-unclassified (SBU). 

The DCS3000 is a modular system that can be set up and configured to meet specific case needs. 
Figure 1 represents a typical configuration for Pen Register collections. Call data is provided 
from toe switch to toe VanGuard, which stores the data temporarily, until it is collected by 
Multiserver and forwarded to toe client. The Multiserver and client could reside on toe same 
workstation. Figure 2 represents a typical configuration for Title III collections at one LEA 
location. In this case the Multiserver and clients are connected via a LAN. Call content is 
provided on a channel independent of toe call data. 
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Figure 1. Typical DCS3000 Configuration - Pen Register 
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Table 4-1 represents sample data channel and content channel delivery mechanisms for 
telecommunications service providers. 


Table 4-1. Sample Interconnection Configurations 


1 Service Provider 

Call Data Channel 

Call Content Channel 

: 


TCP/IP over ISDN, 

Dial-out from switch to 
directory number 


TCP/IP over leased line 

Dial-out from switch to 
directory number 


TCP/IP over dedicated 
connection (frame relay or 
VPN) 1 

Dial-out from switch to 
directory number 


TCPjIP over dedicated 
connection 

Dial-out from switch to 
directory number 

1 Generic Wireline 

TCP/IP over X.25, ISDN BRI , 

T1 


4.2. Information Transfer and Collaboration 

The DCS3000 is connected to and transfers data from the telecommunications service provider 
via TCP/IP. The connection can be established either by the DCS3000 or by the switch. 

4.3. Hardware 

The following subsections list and describe the major hardware required to operate the DCS3000 
system. 

4.3.1. Workstations 

DCS3000 can be installed on any Pentium-based workstation running Microsoft Windows 2000. 
The minimum memory requirements are the same as the minimum required for running the 
operating system. 

Client workstations must have a Recorder Control Interface (RCI) card and recorder to support a 
Title III collection. A separate Client workstation is needed for each Title III target. 

4.3.2. Data Communications Equipment 

DCS3000 uses the following telecommunications equipment to establish data communications: 

• Cisco 1610 router 

• US Robotics Courier V.Everything External Modem 

4.4. Software 

The following subsections list and describe the major software required to operate the DCS3000 
system. 

4.4.1. Operating System 

All DCS3000 applications run imder the Microsoft Windows 2000 operating system. 
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4.4.2. DCS Applications 
Please refer to section 3.1 above. 

4.4.3. Security Software 

The DCS3000 system employs McAfee VirusScan anti-viral software. 

4.5. Maintenance 

The DCS3000 Users’ Guide includes maintenance procedures that include preventive 
maintenance, scheduled to maximize the availability of the system, and thus to minimize 
interference with the operation of the system. TICTU provides on-call maintenance support of 
fielded systems. 

5. SECURITY 

5.1. vSvstem/Facilitv Access 

I Initial entry to 

field offices is controlled by guards or other assigned personnel who identify and verify 
personnel through the use of picture badges and other forms of identification (ID). Generally, 
two forms of ID are required before entry into a field office is permitted. Swipe badges are then 
used to release electronic door locks or activate turnstiles so authorized persoimel can enter the 
btulding. If a person does not have adequate ID, a member of the visited activity will escort 
them. The DCS3000 operational areas are protected by swipe-badge mechanisms that verify 
proper badge ID and also by electronic combination locks that require the proper codes in order 
to gain access to various rooms within the facility. 

FBI system users receive background checks based on their job function before they acquire 
system privileges in accordance with the FBI personnel policy. Non-Bureau personnel who are 
required to perform maintenance on DCS3000 within a central monitoring plant (CMP) may be 
approved for escorted access based on an FBI-conducted Limited Background Investigation. 

5.2. Physical Environment 

DCS3000 systems physically reside in FBI field offices within CMPs. Because the DCS3000 
resides in the field offices, access to CMP housing the system is restricted to authorized 
personnel only. Central monitoring plants are locked at all times and controlled by a variety of 
access control devices and procedures. Authorized personnel escort any unauthorized personnel 
(e.g., maintenance personnel, facility support contractors) in order to monitor their activity while 
in the CMP. 

5.3. Data Storage Media 

Though the primary function of this system is not data storage, it does store some data 
temporarily before it is collected by the Multiserver and forwarded to the client. Call data is 
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provided from the switch to the VanGuard and temporarily stored until the MultiServer collects 
it and sends it to the client. 

5.4. Backup and Recovery 

The DCS3000 provides a capability to conduct backup storage and restoration of data and access 
controls. The DCS3000 Users’ Guide includes recovery procedures that assure that system 
recovery is done in a trusted and secure manner. 

The DCS3000 backup capability provides for the restoration of any security-relevant segment of 
the system state (e.g., access control lists, cryptologic keys, deleted system status information) 
without requiring destruction of other system data. 


6. POINTS OF CONTA CT 

I DCS3000 Program Manager 
bBl investigative lecnnology Division (ITD) 

FBI Engineering Research Facility (ERF) 



Senior Systems Analyst (Contractor) and ISSO 
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then sends a delete request to the Recording Workstation to remove the initial recording. This 
computer is connected directly to the DCS6000 LAN network. 

The Recording Workstation 

The Recording workstation receives call content firom the telecommunication service provider 
and call data from the DCS3000 system via DCSNet forming a complete session record. This 
workstation adds input received from LEA personnel to the session detail and records it in 
formats that are appropriate for use as evidence. This recording is stored in the database and 
written to MO media by other components of the system. This computer is cormected directly to 
the DCS6000 LAN network and telecommunication service provider lines. This workstation 
may collect data within the Title III, Cooperative Warrant, or one Push-to-Talk (PTT) collection 
guidelines. 

The Audio Workstation 

The Audio Workstation is used by LEA to monitor call content in real time and playback of 
audio captured after the call session has ended. This computer is connected directly to the 
DCS6000 LAN network. 

The CD-RW Workstation 

The CD-RW Workstation is used to control and write data to multiple CD-RW and / or DVD-R 
drives to produce working copies of evidence collected. This computer is connected directly to 
the DCS6000 LAN network. It receives data from the Site Manager Server, Recording 
Workstation or Audio Workstation and writes it to MO drive. 

The Archive Host 

The Archive Host is used to control and write data to multiple MO drives to produce both 
evidence copies and working copies of evidence collected. This computer is cormected directly 
to the DCS6000 LAN network. It receives data from the Site Manager Server and writes it to 
Mp drives and verified, this computer notifies the site manager that the session has been 
archived. 

The Offline Analytical Workstation 

The Offline Analytical Workstation is used for playback of recordings only. ITiis tool is 
provided as a convenient method of reviewing evidence collected in preparation for cases. The 
workstation platform used for this purpose is equipped with a MO drive and CD-ROM / DVD- 
ROM reader. It is never directly connected to Ae rest of the system. 

The Courtroom Laptop 

The Coiutroom Laptop is used for playback of recordings only. This tool is provided as a 
convenient method of delivering the collected evidence in coxirt. The laptop platform used for 
this purpose is equipped with a MO drive and CD-ROM / DVD-ROM reader. It is never directly 
connected to the rest of the system. 
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3.3. User Organizations and Personnel 

In addition to cognizant system management and engineering personnel at the TICTU located 
within the FBI ERF, other user personnel are found at FBI field offices throughout the United 
States and Puerto Rico. 

4. SYSTEM OPERATIONAL OVERVIEW 
4.1. Networking Infrastructure 

The DC6000 is connected to the telecommunications service provider via phone lines to include 
single line analog, Integrated Service Digital Network (ISDN), and T1 lines. The connection is 
always established by the telecommunication service provider and passively monitored by 
components of the DCS6000 system and LEA personnel. Data transmitted to the DCS3000 in 
support of Title III, Pen Register, or Cooperative Warrant collections is sensitive- but- 
unclassified (SBU). 

The DCS6000 is a modular system that can be set up and configured to meet specific field office 
or case needs. Figure 1 represents a full configuration for ongoing collections. Call data is 
provided firom the telecommunication service provider and DCS3000. Figure 2 represents a 
small oiffice configuration for Title HI collections at one LEA location. In this case the functions 
mentioned above are combined into one computer platform. 
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Figure 2. Typical DCS6000 Configuration - Small Site 


4 . 2 . Information Transfer and Collaboration 

The DCS6000 is connected to and transfers data from the telecommunications service provider 
via analog and digital telephone lines. The connection is established either by the telephone 
service provider switch. 

The DCS6000 is connected to the DCS3000 via a PK firewall to allow for the ingest of PIN 
register and Push to Talk data as well as anti-virus updates. The connection is establish^ by 
either system on request of the DCS6000 system. 

4.3. Hardware 

The following subsections list and describe the major hardware required to operate the DCS6000 
system. 
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4.3.1. Workstations 

DCS6000 can be installed on any Pentium-based workstation running Microsoft Windows 2000. 
The minimum memory requirements are the same as the minimum required for running the 
operating system. The following additional hardware is also required. 

• Recording Workstations must have telephone receiver cards and to support a Title III 
collection. 

• External MO drive storage cabinet 

• External single MO drive reader 

• External CD-RW / DVD-RW cage 

• Audio Hosts must have a SCSI card to support connectivity to MO drives. 

4.3.2. Data Communications Equipment 

DCS6000 uses the following telecommunications equipment to establish data commimications: 

• 3Com SuperStack III Switch (used for LAN connections within the system) 

• Cisco PDC 5 13E Firewall (used for controlling connectivity to the DCS3000 system) 

4.4. Software 

The following subsections list and describe the major software required to operate the DCS6000 
system. 


4.4.1. Operating System 

All DCS6000 applications run under the Microsoft Windows 2000 operating system. The Voice 
Box Server employs the Standard Server version of the Operating system. All other computers 
employ the Professional version of the operating system. 

4.4.2. DCS Applications 

The DCS6000 employs the following software: 

• JSl Telecommunication Voice Box HI software suite 

• Microsoft SQL Server 2000 (installed on Voice Box Server only) 

• Microsoft Office 2000 Professioiuil 

• Corel Perfect Office 

• Adobe Acrobat 

• Network Associates Mcafee Antivirus 
4.4J5. Security Software 

The DCS6000 system employs McAfee VirusScan anti-viral software. This software is updated 
on a routine bases by pulling DAT files from a known location on DCSNet. 
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The FBI's Telecommunichtidns'Intfei^^ Technology Unit's 

(TICTU) mission is td erisure tliat^^^ to acb|ss'&d coll^ evidence and 
intelligence through .the developmentj dep^^^ of wireline and 

wireless electronic survQillancel(ELSl^ intercept capabilities, as well as the 
development andMeployment-df field office management and 

collection systeMs. ■ / / '>■ ■ 

Who We Are _ ‘i ' ‘ ~ f ^ 

Agents and ptofesSiorial support personnel, including electebri^^^ and mechanical 
engineers, electronic technicians, and compulehand Togisfics; sp^ who are 

committed to: excellence. - 


WhatWeDov . . . 

The TICTU is the field'dtechnical partner. The TICTU tedtpr specialists have diverse 
technical expertise in surveillance, collection, informa:tion management, and 
intelligence-gathering resources^ The result is an abilij^'tb support field personnel 
throu^ the development of sopjiisticated s;^ manner. 
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TICTU Overview 


• TICTU develops^ deplby^^^ 
advanced inlerceptip^^a^]^ 

• On^ rjeques^^^CTU provides simila 
to o^er 5federai| irtate, 

• D^^aO0,J0CS-5OOO, and pt^4p(^^re is th^ 
current Data GoUection Systemsi^C^ 
solutions used by the FBI. 

• The FBI is investigating^ other opiti from 


outside vendors. 
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Background 


Pro^jfam^ 

Digital Collection suppoitSj/the.FK of the FBI to 

collect evidence an^'fhtdlligene^.&bw^l^^^ and support 

of communication^inteircdptibiJi tee&qu^^ tb facilitate and support 

national security, doihestic counterterrorism, and criminal inVpstigative efforts. 
Systems being acquired 'Unddl.^e.Dtgital Gpnect^^ systems 

(foreign counterintelligphcfe ’^dilaSySenfor^^^ Aa# possess similar functions 
and capabilities to iritercdpKteleph^ miCfophohe, ^df fac^^ communications 

Within the FBI, the TIGTU is the primary technical ^ for the court- 

authorized interception qfvvireline and \vireless communiCatiphs. The Digital 
Collection Systems (ACSs)vWithin the TICT^ consist 6fthefpirbwi three 
projects: DCS-3bOG, DCS-5000, and DCS-6000, whichOroyidb digital collection 
tools, foreign couhteirintelligehce gathering, and law enforcement evidence 
collection, respectiv|iy._ _....^ •. ^ ^ 
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Background (Continued) 


In late 1996, TICTU spe^laeaded thej,deydid|Jment of k 

access program called tfte DC, S-3Q0d; aii^ provide an interim 

solution to intercepts bdsed oh Gb&!nUm^ati|ns^^A^^^ Act 

(CALEA) inputs. Tphls system W|siddsi^ed'& with the switching facilities of 

wireless carriers that began beplb^^ing new digital tecmiblogies anb: Offering diverse 
"Personal Comrn^catiphs $eryi'Ges." Since mat t evolved into 

a viable interim spjlutiori'j capable intp ^odels of wireline and 

wireless switches^';, i \ \ v 'Vv- 


Other systems und er the Digital- Collection Project include the‘DCST:ld 1 

formerly knowrias f ~| ahd the DCS-6000 (VbiceBox^, fonn'eriy known as 

Digital Storm. The uus-suuu and DCSt 6000 systems possess simil^fu and 
capabilities;, however, the prirnaiy difference between &e .sykemsls;i^^ DCS-6000's 
requirement to monitor intercepted communication as it is recorded and to minimize 
the communication uiaGcordanbe;.with the court order/authorization: 
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Plan Summary (Budget & Spending) 

2005 I LIFECYCLE COSTS 


SPEND PLAN 


FY 

Planned 





DCS3000 

$3,268,373 

$3,096,319 

DCS5000 

$17,648,241 

$14,047,566 

DCS6000 

' $11,547,615 

$8,160,193 

Other 

$4,030,289 

$1,988,449 








DCS3000 

$3,096,319 

$4,314,977 

$5,177,942 

$6,213,530 



DCS5000 

$14,047,566 

$16,142,816 

$19,371,379 

$23,245,654 



DCS6000 

$8,160,193 

$9,551,532 

$11,461,838 

$13,754,205 



Other 

$1,988,449 

$1,909,085 

. $2,290,902 

$2,749,082 
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Phase 3 
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slligence through the development deployment, ai 


D8 DIgHal Collection Infrastructure (DCS6000) 

Purchase, training, and installation of DCSaooo ayate 
DCS6Q00 systems provide digital ELSUR collection and 


These systems support Criminal Investigative 1 
New Equipment S Upgrades 
DCS6000 Collection Systems 


Maintenance of fieided DCS6000 systems, 
used for hardwans maintenance and softw 
JSI VolceBox systems. These systems su 
III Investigations. 

Maintenance 

DCS6000 Acquisition & Planning 
DCS300Q/CALEA Compliance 
Engineering Services 


ns. Funding will b a ■ 
Ftware upgrades to|_| 
support on-going Title 


555 


D5 DigKaJ CoDection Infrastivctura (DCS-5000) 









¥ 


¥ 


Services of fax intercept and collection equipment In support of CID 
DU DFP202 and CD ELSUR actMees. 




SIT 

smoo 


KB SIT101 
SIT102 


OCS-3000 
DIVISION FUNDS 

DCS-3000 Operations. Includes engineering studies fbr the 
upgrade of existing intercept systems to address new 
telecommunication technologies. Fiscal year 2005 funding vriil be 
utilized for development of switch protocol Interfaces, and lor 
system operator training. This equipment supports 
counterintelligence, domestic counterterrorism, and criminal 
investigations. 

DCS-3000 Development Effort 

DCS-3000 Development Effort Davelopmentof the intercept 
capabilities directed toward digital cellular, enhanced sperSallrad 
mobile radio, satellite, personal communications services, and 
networir-based communications via switch-based netwodrs for 


819,328 




S73000JM 


395 S73000IC 
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748,700 


Unit Overtiead 
PS1 01 Parts & SuppRes 
TRNG101 Training 
MISC101 Unit Overhead 
MISC102 
MISC103 


2,104,817 

1,992.305 


16,195 

4,173 0 S82B-1 

12,022 - zsos 


Equipment 

Professional Services 
Parts & Supplies 



2,077,023 1,238 

2,798,700 1,724 

112,312 1 

5,191,300 
1,992,305 


18,604,478 1,141 

3,050,345 350 

4,173 0 

2,651,660 1 
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HH 

Support In planning arid execution ot individual project | 
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Technical Issues Analy^ Support 



BWH 
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successfully meets its objectives. 
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items to be purchased for research and development 
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ODC/Travel 
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DCS3000 Development 
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E001999 Oracle 

E002668 Windermere 

Transferred from DS206 (Training ) 

, ^Tra nsfer, to ’fi aditloftal for Sen/ices (S/1 )^ I 

CA D5204 DCS5000 Acquisition & Planning 

E002537 BAE IT Resources 

E002185 UNIX Support 

Rescission 
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PS101IC Parts and Supplies 
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(U) Item Name: 


Telecommunication ELSUR 


(U) Budget Decision Unit(s): 

(U) Strategic Goal(s) & Objective(s): 
(U) Organizational Program: 


Intelligence 
1.1, 2.3 

Operational Technology 


(U) Component Ranking of Item: 

(U) Program Increase: Positions Agt^ lA^ FTE ^ Dollars 
$ 1 1 .650.000 ( non-personnel) 


(U) The DCS-3000 system is custom developed, deployed, and supported by the FBI. 
DCS-3000 provides access and collection of both call detail information (i.e. pen-register 


and tran/trace'l and call content for a variety of telecommun 
technologies such aJ I 

ications switches.|£m££m^ 
elephony services! j 

Services 

|wiii require luture moamcations 


certification and accreditation of the CALEA interface t( 


1 wireless communications technologies and an increasing amount of wireline 


technologies. An enhancement request of $1 1,650,000 is necessary to take a proactive 
stance in the face of emerging technolog ies. Today's headlines announcing the first bold 
steps of major service providers adopting 


(U1 Justification 

(U) The requested enhancements will augment the FBI’s capabilities to provide 
immediate access to, and the dissemination of intercepted information. As technology 
continues its unabated growth, law enforcement will face increasing challenges from the 
convergence of voice and data technologies, threatening their ability to identify subjects 
and then access and collect call content information. The FBI must continue to develop 
and deliver vital technical investigative tools and services to meet these challenges. 


Requested Item 

Unit Cost 

Number of Units 

Total 

Engineering Services 

$160,000 per 
person 

S people 

$800,000 


$120,000 

70 nodes 

$8,400,000 

DCS-3000 system upgrades 

$10,000 

65 

$650,000 

Engineering Services - DCP 

$1,800,000 


$1,800,000 


ALL BTFOPILATIOII COHTAIHEU 

HEFEIF IS U1ICLA33IFIED 

DATE 06-08-2007 BY 65179DMH/KSR/LHF 




(U) Engineering services ($800,000) are requested for the design, development, and 
delivery of access systems for non-Communications Assistance for Law Enforcement Act 
(CALEA) and CALEA-compliant telecommunications switches. These systems are 
essential on an ongoing basis to address intercept issues related to emerging 
telecommunications technologies. The requested engineering services are principally for 
software development but may also include liaison activities with telecommunications 
carriers. 


(U) The DCSNet ($8,400,000) is a certified and accredited IP network used by the FBI 
for real-time transport of CALEA-based ELSUR information (pen-register and call 
content) from telecommunications carriers to F BI field offices. The DCSNet provi des 
ELSUR access to all 56 FBI field offices with 

order to keep pace with CALEA-compliant solutions^r ^^^"^^^^^^^^!, the 
FBI must enlmce the ba ndwidth to all access nodes on the DCSNet. The prop osed 
DCSNet enhancement of | T circuits at each node will provide^ 
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the bandwidth and speed necessary to the FBI. The enhancement will allow deployment 
o fl I It will allow the addition of Voicebox capabilities 

into the current regional concept. T he enhancement, as requested, could accommodate a 
shift of I I As a bv-product of the requested en hancement, the 

DCSNet could ea.silv accommodate ! b t all node sites. 

This enhancement would allow TICTU to make the network more available to the field 
so that no mission critical data is lost. 


(U) Access system upgrades/replacements ($650,000) is requested for aging CALEA 
access/collection systems that are in operation in all 56 field o ffices. Processing ^ d 
storage requi rements for access and collection systems for new j | 

1 I will mandate the periodic upgrade of all access and collection systems used 

by the FBI. 

(U) Engineering Services ($1,800,000). Operating the Dedicated Contractor Support 
Program (DCSP) at a reduced staffing level is putting a significant strain on existing 
personnel to meet all critical ELSUR system support requirements. The strains are 
compounded by the significant increases in requirements for ELSUR support to criminal 
investigations. The DCSP cannot effectively support these expanding requirements 
without an adequate level of resources. The requested $1,800,000 will provide sufficient 
funding to increase the current complement of contract persoimel supporting this program 
from 33 to 45 and provide them with the necessary tools to ensure success of the 
operation. The requested enhancement will provide an additional twelve contract 
personnel to locations that do not currently have on-site support and will provide the 
necessary funding to satisfy several outstanding requests from various field offices for 
additiond persoimel. 


fU) Imc 

□ 


Irngact_onPe^nnance_^RelationsWgof^^^e^^ 


hi 
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solutions for merging telecommunications technologies will halt most of the FBI's 
telephony interception and collection. Without the continued use of engineering services, 
the FBI will not be able to keep pace with the advancement of technology nor maintain 
the technical capabilities that are necessary to support most major investigations. The 
available DCSNet bandwidth will dictate the number and efficiency of the CALEA 
intercepts the FBj^erfonns^^h^ac^^^ufficien^andwidtl^wi^SSill^l^flS^^^lflll. 
content forne^ T^ I I 

I I These services are only increasing in number and bandwidth usage, 

rkllhrd to ehhance network speed will create a network overload situation. Many of the 
DCS-3000 systems in operation are using dated hardware technology (e.g. 500 MHz 
Pentium-based personal computers). None of these systems hav e the processing a nd 
storage capacities necessary to meet the ELSUR requirements fol I ^ 

I Hlf 

the existing systems are not upgraded to meet these requirements, the FBI will fail to 
maintain current levels of collection efficiency. 

(U) If the requested level funding is not attained, the existing dedicated contractor 
workforce will be reduced and the DCSP will be unable to support field office requests 
for system set-up, administration, maintenance, and user training associated with critical 
criminal investigative cases. This reduction will have a devastating impact on the support 
provided to fielded F.T.S ire systems and their associated users. It would reduce Title III 
system/case support from l b d would severely reduce support to 

development of operational tools and guidance provided to field personnel. Additionally, 
the help desk support currently being provided will be impacted. The ELSUR systems 
will not receive the required attention which will likely result in loss of data collection. 
Response time to correct deficiencies and to install patches and upgrades will be 
increased. Overall system integrity will suffer and systems will fail, resulting in the loss 
of critical criminal information. 
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ROUTE TO; 

1) Unit Chief (up to $25,000) 

2) Section Chief (over $ 25 , 000 ) 

3) SRU - attention; Tina Smith 


P or SRU use oi 
R#; 


OPERATIONAL TECHNOLOGY DIVISION 
REQUEST FOR TRAVEL AUTHORIZATION NUMBER 


A TR number is requested for the following: 


DATES OF TRAVEL 
FROM; 


TOTAL ESTIMATED COST $ 


Check ONLY one box below: 

Boxes that indicate "unfunded" have no base funding allocated. A transfer of funds must be requested in order to receive a TR 



If you have requested a TR number from an "unfunded" source, you must provide funding information 
indicating which of your unit accounts (or other TR account) the funds will be transferred from. TR 
numbers cannot be assigned to an unfunded source without transfer information. Please see your 
budget point of contact in your unit regarding transfers. 


Please transfer funds in the 

amount of: $ | 165,000] 

(whole dollars) 


From account (or TR): 

FY / SOC / COST CENTER: I 07/573000JM/1 822 


DO NOT ALTER THIS FORM. ALTERED FORMS WILL NOT BE ACCEPTED. 
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From: 

1 kOTDHFBI) 


Sent 

' Wednesdav. Uecembl^r 28. 20Ub 1U:13 AM 


To: 

1 DTDUCONI 


Subject: 

Video card justification 

L ^ 
hlc 


UNCLASSIFIED 

NON-RECORD 

b7E 

I ( lere is the justification: 

The video cards are needed for the PCSSOPo T b roiect. The video cards will be used to modify current DCS3000 

computers to provide the ability to view two monitors with separate applications at the same time. 


UNCLASSIFIED 


ALL IlfFORJIATIOII COHTAIHED 

HEEED: is TUfCLASSIFIED 

DATE 06-08-2007 BY 6S179DHH/K3R/LHF 


From: 

Sent: 

To: 

Cc: 

Subject: 


I l(OTD) (FBI) 

Ihursdav. yepiember O?, 2006 9:33 AM 

E lf OTDVCON) 

Anywhere Justrftc^ n 


he 


b"7C 


UNCLASSIFIED 

NON-RECORD 


He;^ 


Here is the blurb: 

Thi^aQfteatftJs rgauired to enat?lgJlifiLlg,tesfflnjiT]tinicsliffns Ip^^fcept and figiififition Tec;moiogy umt to support the field 

‘ now nr:.c!-:^nnn sv/gtems nat 


support those installations. 


3 llfip.tinn Tec| ^nol 
nCTU need^ 


UNCU^SS IFIED 


ALL IlfFORmTIOII COWTAIIIED 

HEPEIir IS OTCLASSIFIED 

DATE 06-08-2007 BY 65179DHH/K3R/LHF 


From: 

Sent' 

To: 

Subject: 


TW: 2UUy Kescissiori" 


(OTD)(CON) 
5 8.41AM 
tOTD) (FBI) 
Impact - SBIT 


UNCLASSIFIED 

NON-RECORD 

FYI... 


b6 

bVC 


I I 

OTD/E STS/TTCTU 
(O) 703| I 

(F)703J 


Original Messa0g;;;;;____^ 

FrQm: L^^^ZZZl (OTD) (FBI) 

Sent: Tuesday. July 25. 2006 8:32 AM 

To: I |[OTD)(CON) 

Subject: WTtSaSSfTIBiplct - SBIT 

UNCLASSIFIED 

NON-RECORD 


I I bVE 

Due to current budget restraints, we are not fully utilizing the Booz Allen and Hamilton contract. Additional cuts would 
reduce the engineering service contract further. 

The amount of service from the BAE contract (employees) will be reduced. 

Purchases of technical equipment to support the operational needs of the field offices will be reduced. 

Our research and development effort, which enables us to be on pace with technology in today’s world, will slow. 
Plans of redundancy for the DCS 3000 system will have to be put on hold. 


Supervisoiy Special Agent 

Telecommunications Intercept and Collection Technology Unit (TICTU) 
Electronic Surveillance Technology Section 
Operational Technology Division 


fee 

b7C 


UNCLASSIFIED 

UNCLASSIFIED 


ALL INFORHATIOIJ COHTAIHED 

HEKEIIJ IS roiCLASSIFIED 

DATE 06-00-2007 BY 6-5179Dr!H/KSR/LI!F 
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Unit: TICTU 


FY2006 Spending Plan 

Base Level Funding 


Remaining 1st 2nd 3rd 4tti 


Account 

Brief Spend Plan Deacripthin 


Quarter 

Quartor 

Qusrtor 

Quarter 

Total 


FY06 detail the purchase of new equipment & system upgrades In 
support of Title III requirements. These platfonns include DCS3000and 
Traditional techniques. The traditional program ^£urchass2la|gj[__^ 






573000JM 



S3.50B.495 

$658,554 

$0 


b7E 

$4,167,049 

5525-6JM 

Contractor support and services for installadon, system administration, 
user support, and quick reaction problem resolution of deployed ELSUR 
systems. Ensure quality assurance through test and evakiatian, data 
analysis, and training. Vendors include, Pitney Bowes($82,489-1sl 
quarter), ETI(525K-1st quarter), JSI ($1M-1st quarter). BAE ($1.1M - 1st 
quarter and $748,700 - 2nd quarter), AQC ($842,51 1 K - 1st quarter). 

$2,207,489 

$1,501,211 

$0 

$0 

$3,798,700 

5-251 5JM 

Maintenance of fielded DCS6000 systems, fax Intercept and collection 
equipmanL Funding used for hardware maintenance and repairs, as 
well as software upgrades. Vendors include JSI ($3,291,900 - 1st 
quarter), ETI ($30K - 1st (Juarter) 

$3,321,900 

$0 

$0 

$0 

$3,321,900 

5626-1 

Supplies to support ongoing purchases, installs, repairs, maintenance of 
all collections systems. Bank One ($65K- 1st quarter). ($47.312 -2nd 
quaiter) 

$65,000 

$47,312 

$0 

$0 

$112,312 


TOTAL - TFSaS 





L 

$11,399,961 1 


Totals must match the Revised Amount Available column from the Balances sheet 


ALL lUFORHATIOlI COHTAIHEI) 

HEFEIN IS UlCLASaiFIED 

DATE 06-08-2007 BY 65179DHH/K3R/LIIF 
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¥ 


¥ 


Unit: TICTU FY2006 Spending Plan 

Base Level Fimtflns 


Remaining 1st 2nd 3rd 4th 


Account 

Brief Spend Plan Description 

Quartar 

Quarter 

Quarter 

Quarter 

Total 

573000IC 

New equipment and system upgrades for Foreign IntelligencB 
Surveillanoe Act (FISA) Digital Collection Systems supporting National 
Security ELSUR requirements. Collection systems to include DCS6000. 
DCS3000, DCS50Q0, and Fax Intercept DCS6000 plan to purchase 2 
new rack systems, 6 portable systems and upgrade of 1 1 Held offices 
from JSI (]%220,650). Traditional wiD purchase tex Intercept and 
collection equipment (5705,818 - ETI). Vendors include Raytheon 
($3,354,703), and various commercial companies including Dell, Hewlett- 
Packard, Cisco, Compaq ($129,802) in 1st Quarter. 2nd quarter to 
include various commercial vendors, Dell ($13,800), Cisco ($92,280), 
TBD ($535,575). Raytheon ($1,388,644) in 3rd Quarter . $2,683,476 tor 
Consolidated Platforms - 2nd Quarter 

$6,410,973 

$3,325,131 

$1,388,844 

$0 

$11,124,748 

552&etC 

Funding wlO be utOized tor vendor technical support services, 
maintenance and repair of deployed systems. Contractor support and 
service for installation, system administration, user support, and quick 
reaction problem resolution of hardware, software, and network 
problems. Vendors include Windermere ($350,000), and Oracle 
($75,000), and BAH ($800,000) in 1st Quarter: and Raytheon 
($2,285,000) and , BAE ($1 ,250.000) In 2nd Quarter . 

$1,025,000 

$3,535,000 

$0 

$0 

$4,S60,XO 

5-2508IC 

Special training tor DCS5000 System Administrators and Operators. 
Also, system maintenance training. 

$0 

$11,5X 

$0 

$0 

$11,500 

5-251 SIC 

Maintenance of fielded OCS5000 Systems. Funding used tor software 
upgrades. Vendors Include Raytheon. 

$0 

$4,600,000 

$0 

$0 

$4,6X,X0 

5-2520IC 

Maintenance of hektedOCSSOOO Systems. Funding used tor hardware 
maintenance. Vendor Includes Raytheon. 

$0 

$600,000 

$0 

$0 

$600.0X 

S62S-1IC 

Supplies to support ongoing purchases, installs, repairs, maintenance of 
all collections systems. Vendors Include Raytheon and other commercial 
companies. 

$75, ox 

$50,000 

$68,992 

$0 

$193,982 


TOTAL • DTP 




L 

$21.0X.240 1 


Totals must match the Revised Amount Available column from the Balances sheet. 
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spending 

Code 


Description of Spending Code 


D5 Digital Collection Infrastructure (DCS-5000) 

Purchase, training, and upgrade of the FBI's Foreign Intelligence Survei 


CA 

D5101 


E002888 


E002949 

(CDW-G) 

E003225 

(CDWG) 

E002839 

(IBM) 

E002591 

(RAYTH) 

E001998 

(RAYTH) 

E002595 

(RAYTH) 

E002916 

(RAYTH) 

E003082 


E002349 


E002668 


E003305 

(RAYTH) 

E002207 

(RAYTH) 

E003396 

(RAYTH) 

E003335 

(RAYTH) 

E003260 


E003083 


i 1 £003350' 


E002753 


DCS-5000 Systems 
JSI Equipment 
Charles Industries 

StoragetekTapes drives. 30ea (for 2850 servers) 
Veritas 

IBM (Cisco Equipment) 

Ancillary Equipment (1st Requisition) 

System (456&Playback) (2nd Requisition) 

Ancillary Equipment (3rd Requisition) 

Servers/Software 

Windemere 

Windemere 

Windemere 

M & Repair (Material), 5 months 
Ancillary Equipment (4th Requisition) 

DMW Conversion Software 
Routers 

Kent's Credit Card 

VEC~Eiec^o nics - 

IFAX (Diva Cards') 

Rescission 

TRANSFER FROM EQUIP MAINT 
TRANSFER FROM UNIT TRAINING 
TRANSFER FROM UNIT FUNDS 
Transfer from Trad & SBIT Remaining 
Transfer from Prof Svc & P&S 


CA 

D5201 

E002207 

Equipment Maintenance 
Transferred to Equipment 
M & Repair (Svc), 10 months 
Rescission (12/05) 

CA 

D5202 

Software Maintenance 

(RAYTH) 

E002207 

Software Maint, 12(-) months 

(RAYTH) 

E002728 

Software Maint, 12(-) months 

(RAYTH) 

E003333 

Software Maint, 
Rescission (12/05) 

CA 

D5203 

E002786 

E002537 

Professional Services 
BAE IT Resources 
BAE IT Resources 
Resfcission (12/05) 
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E001999 Oracle 

E002668 Windermere 

Transferr ed from &5206 (Trai ning ) 

^ - Transfer to Equipment 

I „ Transfer to T raditio nal f or Service s (5/1) 

CA D5204 DCS5000 Acquisition & Planning 

E002537 . BAE iT Resources 

E002185 UNIX Support 

Rescission 

KB D5205 DCS3000 (E002040) 

CA D5206 DCS5000 Training 

PS101iC Parts and Supplies 

E002088 9.1GB MO, lOOOea 

E002756 9.1GB MO, lOOOea 

E003083 Kent’s Credit Card 

RescissionJ12/05) 

L. - --- - Equjpmgnt^ J _ 
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$ 16,497,623.00 $ (90.43) 100% 

illance Act (FISA) Digital Collection Systems. 


3.631.00 $ (90.43) 100% 

6 , 110 . 00 ) 

3,026.28) A6ITD02I 

1,428.68) 

5,736.86) 

4,778.40) 

3.493.00) 

6,835.71) 

4,949.67) 

5.264.00) 

9.000. 00) 

6,750r60)] S6D0113 

8.750.00) 

5.000. 00) 

0,136.00) 

8.285.00) 

4, 327.2 3) 

1000.00) : 

4.555.00) 12 1. _ Z1__Z I 

B,800_^00)j~- This will decrease to $131,215" 

3.386.00) 

1.054.00 

1.245.00 

266.00 

1,180.40 

5.145.00 


600,000.00 $ 

(391,054.00) 

(190,000.00) 

(18,946.00) 


4,600,000.00 $ 
(2,075,000.00) 
(2,075.000.00) 

(304.747.00) 

(145.253.00) 


2,360,000.00 : 
(530,000.00) 

(358,203.00) 

(1,000,000.00) 
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I«» «»]«» 


(74,034.44) 

(373.579.00) 

100 , 000.00 

T99.183.56) 

( 25 , 000 . 00 ) 

1,500.000.00 $ 

(1,086,797.00) 
(300,000.00) 

(113.203.00) 


193,992.00 $ 

(50,500.00) 

(50,000.00) 

■"OXbdo.6d)l 

(T531.d(^ 

"T7p61 00) ■ “ 
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Spend Plan#: 06.2-1822 


Project Summary - Operational Technology Division (OTD) - TICTU 


Current Obligations/ Planned Current Planned 

Project Name Account oomminoa E^^njUures (72%) Available Obllgatlons/Expendituree 

Allotment Balance 

As of March 13. 2006 3rd Quarter I 4th Quarter 











